MLeap TensorFlow Bundle.ML Model Format PoC

This repository contains a local-only proof of concept for a model format vulnerability in TensorFlow-backed MLeap bundles. A malicious .mleap bundle can embed a TensorFlow graph.pb containing file operations and use MLeap TensorFlow metadata to execute those operations during normal inference.

Target: MLeap (.mleap) – Spark
Affected condition: mleap-tensorflow is on the classpath
Tested commit: 027342cac5c96d6cb4f56046634a5f0487849a67
Tested version: v0.24.0
Reproduced with: eclipse-temurin:17-jdk-jammy
Image digest observed: sha256:beabb759e6f9653c843958d1d1f5cecb881dfb85aa6081e2bef099ab1260344e
Container OS: Ubuntu 22.04.5 LTS, linux/amd64
CPU assumption: AVX-capable x86_64 CPU; the test container reported avx and avx2

Included Bundles

mleap_tf_target.zip: uses nodes: ["write_poc"] so MLeap calls TensorFlow Runner.addTarget("write_poc"), executing a WriteFile operation.
mleap_tf_control.zip: has no nodes field; the fetched output has a TensorFlow control dependency on WriteFile.
mleap_tf_read.zip: uses TensorFlow ReadFile and returns the local file content as a string prediction output.

Each bundle contains:

bundle.json
root/node.json
root/model.json
root/graph.pb

Reproduce

From this repository root:

mkdir -p /tmp/docker-no-creds
printf '{}' > /tmp/docker-no-creds/config.json
chmod +x run_linux_tensorflow_pocs.sh

DOCKER_CONFIG=/tmp/docker-no-creds docker run --rm --platform linux/amd64 \
  -v "$PWD":/audit \
  -w /audit \
  eclipse-temurin:17-jdk-jammy \
  /audit/run_linux_tensorflow_pocs.sh

The script performs a fresh clone of MLeap, checks out 027342cac5c96d6cb4f56046634a5f0487849a67, compiles mleap-tensorflow, generates the malicious bundles, loads them with public MLeap APIs, and calls normal transform(...).

Expected Output

PoC A, addTarget file write:

output=13.37
proof_path=/tmp/mleap_tf_poc.txt
proof_exists=true
proof_contents=mleap tensorflow addTarget poc

PoC B, control-dependency file write:

output=13.37
proof_path=/tmp/mleap_tf_poc_ctrl.txt
proof_exists=true
proof_contents=mleap tensorflow control dependency poc

PoC C, file read into prediction output:

output=mleap-secret-from-host
proof_path=/tmp/mleap_tf_secret.txt
proof_exists=true
proof_contents=mleap-secret-from-host

Local Test Scope

All testing is local and only touches /tmp inside the test container. No production systems are contacted. The PoCs do not require network access during inference, custom TensorFlow native operations, or attacker-provided code outside the .mleap model file.

See evidence.md for bundle listings, extracted root/model.json files, graph strings, and full terminal output from the Docker reproduction.